Solved Gnuton RT-AX58U v2 issues with cake and skynet.

[DJones]

Beta 388.7_1 having issues with Skynet and Cake using Gnutons 388.7_1 beta finding the IPtables do not load for Skynet and Cake doesn’t seem to work at least in in function for bufferbloat on the same cake configuration as my main router which uses Merlin’s main firmware.

Might not be the right place to discuss this, not looking to fix a beta firmware or bug; I’ve put in a ticket on git. But just trying to get a judge on if this is an issue with my router just not cooperating or a bug others are experiencing with this model of router RT-AX58U v2 no issues with Merlin’s main firmware.

 

[dave14305]

What errors do you get if you run:

ipset create Skynet-MasterWL list:set
ipset create Skynet-Master list:set
iptables -t raw -I PREROUTING -i br+ -m set ! --match-set Skynet-MasterWL dst -m set --match-set Skynet-Master dst -j DROP

Looks like there was already a known issue:

Skynet not working on TUF-AX3000 V2/ RT-AX58U_V2 · Issue #559 · gnuton/asuswrt-merlin.ng

Skynet not able to run on TUF-AX3000_V2

github.com

 

[DJones]

ASUSWRT-Merlin RT-AX58U_V2 3004.388.7_1-gnuton0_beta1 Thu May 9 07:52:36 UTC 2024
@RT-AX58U-B260:/tmp/home/root# ipset create Skynet-MasterWL list
:set
ipset v7.6: Set cannot be created: set with the same name already exists
@RT-AX58U-B260:/tmp/home/root# ipset create Skynet-Master list:s
et
ipset v7.6: Set cannot be created: set with the same name already exists
@RT-AX58U-B260:/tmp/home/root# iptables -t raw -I PREROUTING -i
br+ -m set ! --match-set Skynet-MasterWL dst -m set --match-set Skyn
et-Master dst -j DROP
iptables: No chain/target/match by that name.
@RT-AX58U-B260:/tmp/home/root#

 

[dave14305]

iptables: No chain/target/match by that name.

What about

modprobe xt_set
iptables -t raw -I PREROUTING -i br+ -m set ! --match-set Skynet-MasterWL dst -m set --match-set Skynet-Master dst -j DROP

 

[DJones]

What about

modprobe xt_set
iptables -t raw -I PREROUTING -i br+ -m set ! --match-set Skynet-MasterWL dst -m set --match-set Skynet-Master dst -j DROP

@RT-AX58U-B260:/tmp/home/root# modprobe xt_set

modprobe: module xt_set not found in modules.dep

@RT-AX58U-B260:/tmp/home/root# iptables -t raw -I PREROUTING -i

br+ -m set ! --match-set Skynet-MasterWL dst -m set

iptables v1.4.15: You must specify `--match-set' with proper argumes

Try `iptables -h' or 'iptables --help' for more information.

Edit: Unfortunately I don’t have much time to work on this router as it’s located at my fathers house. I’d vpn in but it’s behind a voip modem I can’t access and doesn’t let a vpn passthrough. Once cake works eventually I can swap that setup to be the router first and the voip modem on lan. But as it stands it causes poor connection on the phone when setup like that. So Cake would be a nice addition. But still early days on this beta, it was supposed to release in may according to git, but gnuton is likely busy.

 

[Tech9]

Unfortunately I don’t have much time to work on this router as it’s located at my fathers house.

You did this complication yourself. Remote router running beta firmware with potentially disruptive blocking script relying on community block lists and perhaps running on USB stick not designed for this type of use and known to fail over time... why? So many failure points for no reason. Your parents perhaps have a few active devices at a time and need something maintenance free. And what is there to QoS so much, hardcore gamers?

 

[DJones]

You did this complication yourself. Remote router running beta firmware with potentially disruptive blocking script relying on community block lists and perhaps running on USB stick not designed for this type of use and known to fail over time... why? So many failure points for no reason. Your parents perhaps have a few active devices at a time and need something maintenance free. And what is there to QoS so much, hardcore gamers?

They live 15 mins away not hard for me to fix if something fails, but remote management over vpn is more convenient for me in some cases. QoS to stabilize their cable internet connection, and prioritize their voip over everything else when the voip over lan port 1. Currently QoS isn’t enabled since the setups works like this atm.

Currently:
Cable modem (dhcp) -> wan of isp voip box (dhcp, but can’t access this device) -> wan of router (dhcp). So it’s like nat central.

Future:
Cable modem (dhcp) -> wan of router (dhcp) -> wan of isp voip modem. But this causes issues without good QoS for the phone.

They only have 17 down 2 up.

I don’t want to use the dhcp server of anything supplied by my isp (except wan) so double nat is inevitable unless I want to start screwing around with my fathers isp’s devices.

Adblocking and community blocklist are just a nice to have, I use it at home even with a USB stick which yes they are known to fail, but never have I had a usb actually die before the router. Most cases any corrupted usb stick happens from not unmounting the stick before doing a firmware update. USB sticks are cheap, since they don’t use the NAS functionality it will limit the writes to the stick. Obviously not as ideal as an external usb ssd in terms of speed. But I’m not convinced it’s something that is necessary they use a ssd or harddrive.

I’m not really a maintenance free kinda guy for my devices, and it’s not a random client I’m servicing otherwise yeah maintenance free is best as most people plug it in and forget about their router.

Well it’s fine for now honestly I can wait for updates from gnuton, nothing serious is wrong with the router just addons clearly are not happy in beta 1 of 388.7_1.

Will likely downgrade on Friday, and verify if the issue exists in 388.6_1.

 

[Tech9]

All you need is in stock Asuswrt already and you just have to investigate further the VoIP issue. Did your parents ask for ad-blocking? The DNS type that can't block any ads in streaming services? AdGuard DNS service does the same thing with no scripts, OpenDNS, NextDNS, etc. as well. Skynet IP-blocker? The default built-in firewall blocks all unsolicited inbound connections anyway. You perhaps copy your own setup there and this is not needed. Keep it simpler and they'll be happier. Only 15min away doesn't mean you're always around to fix whatever is not working. They have to wait for you.

 

[DJones]

All you need is in stock Asuswrt already and you just have to investigate further the VoIP issue. Did your parents ask for ad-blocking? The DNS type that can't block any ads in streaming services? AdGuard DNS service does the same thing with no scripts, OpenDNS, NextDNS, etc. as well. Skynet IP-blocker? The default built-in firewall blocks all unsolicited inbound connections anyway. You perhaps copy your own setup there and this is not needed. Keep it simpler and they'll be happier. Only 15min away doesn't mean you're always around to fix whatever is not working. They have to wait for you.

You absolutely have a point. Probably overthinking things, and complicating it with additional failure points. They used a ddwrt router I gave them years ago worked solidly until it shirt the bed after I updated it a week ago. I’ve lost a few routers over the years using ddwrt, that said better than a consumer router that neglects providing updated firmware for their device. Asuswrt-Merlin was a much friendlier experience than openwrt, tomato, or ddwrt so yeah tried to copy my setup for them.

 

[Tech9]

I would use stock Asuswrt there, install uBlock Origin on their compatible devices and give them a choice what they want to see. It's one click on/off deal, clears YouTube from ads, protects from malware, etc. AiProtection enabled, perhaps Adaptive QoS with VoIP on top. No USB sticks, no 3rd party firmware, no scripts and swap files. VPN Server for you to help remotely when needed, small UPS to keep the system going during power disruptions.

I have an older Cisco wired router in my parents' place with few access points around, OpenDNS upstream, ad-blocking on devices they use and only if they want to, AnyDesk straight to their two laptops for updates and some maintenance. This thing can do uptime forever when not disturbed.

 

[Adamm]

The issues with Gnuton builds and Skynet has been identified by @GNUton and will be resolved in future releases of the firmware.

 

[DJones]

Thanks @Adamm